https://github.com/spring-projects/spring-security/issues/11027 has changed the Spring Security default by applying authorization to every request.
Currently, to apply the FilterChainProxy to all dispatcher types using Spring Boot, one can do:
spring.security.filter.dispatcher-types=request,async,error,forward,include, where the default are just request,async,error.
Spring Boot should register the FilterChainProxy to all dispatcher types by default to better align with Spring Security defaults.